Multiparty computation unconditionally secure against adversary structures Adam Smith
Anton Stiglic
24 July 1998
Abstract
We present here a generalization of the work done by Rabin and Ben-Or in [RBO]. We give a protocol for multiparty computation which tolerates any active adversary structure based on the existence of a broadcast channel, secure communication between each pair of participants, and a monotone span program with multiplication tolerating the structure. The secrecy achieved is unconditional although we allow an exponentially small probability of error. This is possible due to a protocol for computing the product of two values already shared by means of a homomorphic commitment scheme which appeared originally in [CEvdG].
1 Introduction 1.1 Multiparty computation
Multiparty computation (MPC) is a cryptographic task that allows a network of participants to emulate any trusted party protocol. Each player starts with a private input . The players run a protocol to compute some function . The result of this function can then be revealed publicly or privately to some particular player. The protocol is deemed secure if cheating parties can obtain no more information from running the protocol than they would in the trusted party scenario (in which each player gives to some external trusted party who then computes and sends the result to all the relevant players). Goldreich, Micali and Wigderson proved that to accomplish MPC it is sufficient to always have the value of revealed publicly and to assume that is given by an arithmetic circuit (i.e. addition and multiplication gates) from to where is some finite field. The first general solution to this problem was given in [GMW]. They present a protocol for MPC which is secure under the assumptions that trapdoor one-way permutation exists, that the participants are restricted to probabilistic polynomial time (computationally bounded) and that the number of cheating parties is bounded above by where . In the situation where the participants can only cheat passively (i.e. by eavesdropping) they can remove the last assumption. In [BOGW] and [CCD], the assumption of computational boundedness is removed and replaced by the assumption that each pair of players is connected by an authenticated secure channel. In this (non-computational) model they prove that MPC is possible with active adversaries if and only if and with passive adveraries if and only if . These results were extended in [RBO] to the scenario in which a reliable broadcast channel is also available. In that case active and passive cheaters can be tolerated if and only if . However, to attain these bounds an exponentially small probability of error was introduced. The result of [RBO] was first extended to more general adversary structures by Hirt and Maurer in [HM97]. However, maintaining an exponentially small probability of error entailed a superpolynomial loss of efficiency. We present a more efficient version of their protocol using monotone span programs, following the ideas of [CDM98]. The relevant definitions as well as a precise statement of our results are presented in the remainder of this section.
"!$#%
& '!$#)(
*!$#+%
./
, -!$#%
School of Computer Science, McGill University, Montr´eal (Qu´ebec), Canada,
[email protected] D´epartement d’Informatique et R.O., Universit´e de Montr´eal, Montr´eal (Qu´ebec), Canada,
[email protected]
1
1.2 Adversary structures and monotone functions Given a set of players under inclusion:
, an adversary structure
2143 0
0
16587"1 :99
JH I K 0 L M 1 ) 1ON 1QP63 40 A 1 SR O1 N UR TTTR 1OP V9
Definition 1 An adversary structure
W X!$#+% HZY H N
0
over
is said to be
if no
sets in
add up to the whole set
Hirt and Maurer ([HM97]) extended the results of [BOGW, RBO] (see section 1.1) which held for to and structures respectively.
1 \]A^[`_ 1 cD*a=98;d\ WDV\ ae ?gf hF ?n f i k \mA hF _ ?gf ijh+F Dlk ijDXkU98;d\ i
